1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Copyright (c) 2017 Facebook 3 */ 4 #include <linux/bpf.h> 5 #include <linux/btf.h> 6 #include <linux/btf_ids.h> 7 #include <linux/slab.h> 8 #include <linux/init.h> 9 #include <linux/vmalloc.h> 10 #include <linux/etherdevice.h> 11 #include <linux/filter.h> 12 #include <linux/rcupdate_trace.h> 13 #include <linux/sched/signal.h> 14 #include <net/bpf_sk_storage.h> 15 #include <net/sock.h> 16 #include <net/tcp.h> 17 #include <net/net_namespace.h> 18 #include <net/page_pool.h> 19 #include <linux/error-injection.h> 20 #include <linux/smp.h> 21 #include <linux/sock_diag.h> 22 #include <net/xdp.h> 23 24 #define CREATE_TRACE_POINTS 25 #include <trace/events/bpf_test_run.h> 26 27 struct bpf_test_timer { 28 enum { NO_PREEMPT, NO_MIGRATE } mode; 29 u32 i; 30 u64 time_start, time_spent; 31 }; 32 33 static void bpf_test_timer_enter(struct bpf_test_timer *t) 34 __acquires(rcu) 35 { 36 rcu_read_lock(); 37 if (t->mode == NO_PREEMPT) 38 preempt_disable(); 39 else 40 migrate_disable(); 41 42 t->time_start = ktime_get_ns(); 43 } 44 45 static void bpf_test_timer_leave(struct bpf_test_timer *t) 46 __releases(rcu) 47 { 48 t->time_start = 0; 49 50 if (t->mode == NO_PREEMPT) 51 preempt_enable(); 52 else 53 migrate_enable(); 54 rcu_read_unlock(); 55 } 56 57 static bool bpf_test_timer_continue(struct bpf_test_timer *t, int iterations, 58 u32 repeat, int *err, u32 *duration) 59 __must_hold(rcu) 60 { 61 t->i += iterations; 62 if (t->i >= repeat) { 63 /* We're done. */ 64 t->time_spent += ktime_get_ns() - t->time_start; 65 do_div(t->time_spent, t->i); 66 *duration = t->time_spent > U32_MAX ? U32_MAX : (u32)t->time_spent; 67 *err = 0; 68 goto reset; 69 } 70 71 if (signal_pending(current)) { 72 /* During iteration: we've been cancelled, abort. */ 73 *err = -EINTR; 74 goto reset; 75 } 76 77 if (need_resched()) { 78 /* During iteration: we need to reschedule between runs. */ 79 t->time_spent += ktime_get_ns() - t->time_start; 80 bpf_test_timer_leave(t); 81 cond_resched(); 82 bpf_test_timer_enter(t); 83 } 84 85 /* Do another round. */ 86 return true; 87 88 reset: 89 t->i = 0; 90 return false; 91 } 92 93 /* We put this struct at the head of each page with a context and frame 94 * initialised when the page is allocated, so we don't have to do this on each 95 * repetition of the test run. 96 */ 97 struct xdp_page_head { 98 struct xdp_buff orig_ctx; 99 struct xdp_buff ctx; 100 union { 101 /* ::data_hard_start starts here */ 102 DECLARE_FLEX_ARRAY(struct xdp_frame, frame); 103 DECLARE_FLEX_ARRAY(u8, data); 104 }; 105 }; 106 107 struct xdp_test_data { 108 struct xdp_buff *orig_ctx; 109 struct xdp_rxq_info rxq; 110 struct net_device *dev; 111 struct page_pool *pp; 112 struct xdp_frame **frames; 113 struct sk_buff **skbs; 114 struct xdp_mem_info mem; 115 u32 batch_size; 116 u32 frame_cnt; 117 }; 118 119 /* tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c:%MAX_PKT_SIZE 120 * must be updated accordingly this gets changed, otherwise BPF selftests 121 * will fail. 122 */ 123 #define TEST_XDP_FRAME_SIZE (PAGE_SIZE - sizeof(struct xdp_page_head)) 124 #define TEST_XDP_MAX_BATCH 256 125 126 static void xdp_test_run_init_page(struct page *page, void *arg) 127 { 128 struct xdp_page_head *head = phys_to_virt(page_to_phys(page)); 129 struct xdp_buff *new_ctx, *orig_ctx; 130 u32 headroom = XDP_PACKET_HEADROOM; 131 struct xdp_test_data *xdp = arg; 132 size_t frm_len, meta_len; 133 struct xdp_frame *frm; 134 void *data; 135 136 orig_ctx = xdp->orig_ctx; 137 frm_len = orig_ctx->data_end - orig_ctx->data_meta; 138 meta_len = orig_ctx->data - orig_ctx->data_meta; 139 headroom -= meta_len; 140 141 new_ctx = &head->ctx; 142 frm = head->frame; 143 data = head->data; 144 memcpy(data + headroom, orig_ctx->data_meta, frm_len); 145 146 xdp_init_buff(new_ctx, TEST_XDP_FRAME_SIZE, &xdp->rxq); 147 xdp_prepare_buff(new_ctx, data, headroom, frm_len, true); 148 new_ctx->data = new_ctx->data_meta + meta_len; 149 150 xdp_update_frame_from_buff(new_ctx, frm); 151 frm->mem = new_ctx->rxq->mem; 152 153 memcpy(&head->orig_ctx, new_ctx, sizeof(head->orig_ctx)); 154 } 155 156 static int xdp_test_run_setup(struct xdp_test_data *xdp, struct xdp_buff *orig_ctx) 157 { 158 struct page_pool *pp; 159 int err = -ENOMEM; 160 struct page_pool_params pp_params = { 161 .order = 0, 162 .flags = 0, 163 .pool_size = xdp->batch_size, 164 .nid = NUMA_NO_NODE, 165 .init_callback = xdp_test_run_init_page, 166 .init_arg = xdp, 167 }; 168 169 xdp->frames = kvmalloc_array(xdp->batch_size, sizeof(void *), GFP_KERNEL); 170 if (!xdp->frames) 171 return -ENOMEM; 172 173 xdp->skbs = kvmalloc_array(xdp->batch_size, sizeof(void *), GFP_KERNEL); 174 if (!xdp->skbs) 175 goto err_skbs; 176 177 pp = page_pool_create(&pp_params); 178 if (IS_ERR(pp)) { 179 err = PTR_ERR(pp); 180 goto err_pp; 181 } 182 183 /* will copy 'mem.id' into pp->xdp_mem_id */ 184 err = xdp_reg_mem_model(&xdp->mem, MEM_TYPE_PAGE_POOL, pp); 185 if (err) 186 goto err_mmodel; 187 188 xdp->pp = pp; 189 190 /* We create a 'fake' RXQ referencing the original dev, but with an 191 * xdp_mem_info pointing to our page_pool 192 */ 193 xdp_rxq_info_reg(&xdp->rxq, orig_ctx->rxq->dev, 0, 0); 194 xdp->rxq.mem.type = MEM_TYPE_PAGE_POOL; 195 xdp->rxq.mem.id = pp->xdp_mem_id; 196 xdp->dev = orig_ctx->rxq->dev; 197 xdp->orig_ctx = orig_ctx; 198 199 return 0; 200 201 err_mmodel: 202 page_pool_destroy(pp); 203 err_pp: 204 kvfree(xdp->skbs); 205 err_skbs: 206 kvfree(xdp->frames); 207 return err; 208 } 209 210 static void xdp_test_run_teardown(struct xdp_test_data *xdp) 211 { 212 xdp_unreg_mem_model(&xdp->mem); 213 page_pool_destroy(xdp->pp); 214 kfree(xdp->frames); 215 kfree(xdp->skbs); 216 } 217 218 static bool frame_was_changed(const struct xdp_page_head *head) 219 { 220 /* xdp_scrub_frame() zeroes the data pointer, flags is the last field, 221 * i.e. has the highest chances to be overwritten. If those two are 222 * untouched, it's most likely safe to skip the context reset. 223 */ 224 return head->frame->data != head->orig_ctx.data || 225 head->frame->flags != head->orig_ctx.flags; 226 } 227 228 static bool ctx_was_changed(struct xdp_page_head *head) 229 { 230 return head->orig_ctx.data != head->ctx.data || 231 head->orig_ctx.data_meta != head->ctx.data_meta || 232 head->orig_ctx.data_end != head->ctx.data_end; 233 } 234 235 static void reset_ctx(struct xdp_page_head *head) 236 { 237 if (likely(!frame_was_changed(head) && !ctx_was_changed(head))) 238 return; 239 240 head->ctx.data = head->orig_ctx.data; 241 head->ctx.data_meta = head->orig_ctx.data_meta; 242 head->ctx.data_end = head->orig_ctx.data_end; 243 xdp_update_frame_from_buff(&head->ctx, head->frame); 244 } 245 246 static int xdp_recv_frames(struct xdp_frame **frames, int nframes, 247 struct sk_buff **skbs, 248 struct net_device *dev) 249 { 250 gfp_t gfp = __GFP_ZERO | GFP_ATOMIC; 251 int i, n; 252 LIST_HEAD(list); 253 254 n = kmem_cache_alloc_bulk(skbuff_cache, gfp, nframes, (void **)skbs); 255 if (unlikely(n == 0)) { 256 for (i = 0; i < nframes; i++) 257 xdp_return_frame(frames[i]); 258 return -ENOMEM; 259 } 260 261 for (i = 0; i < nframes; i++) { 262 struct xdp_frame *xdpf = frames[i]; 263 struct sk_buff *skb = skbs[i]; 264 265 skb = __xdp_build_skb_from_frame(xdpf, skb, dev); 266 if (!skb) { 267 xdp_return_frame(xdpf); 268 continue; 269 } 270 271 list_add_tail(&skb->list, &list); 272 } 273 netif_receive_skb_list(&list); 274 275 return 0; 276 } 277 278 static int xdp_test_run_batch(struct xdp_test_data *xdp, struct bpf_prog *prog, 279 u32 repeat) 280 { 281 struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info); 282 int err = 0, act, ret, i, nframes = 0, batch_sz; 283 struct xdp_frame **frames = xdp->frames; 284 struct xdp_page_head *head; 285 struct xdp_frame *frm; 286 bool redirect = false; 287 struct xdp_buff *ctx; 288 struct page *page; 289 290 batch_sz = min_t(u32, repeat, xdp->batch_size); 291 292 local_bh_disable(); 293 xdp_set_return_frame_no_direct(); 294 295 for (i = 0; i < batch_sz; i++) { 296 page = page_pool_dev_alloc_pages(xdp->pp); 297 if (!page) { 298 err = -ENOMEM; 299 goto out; 300 } 301 302 head = phys_to_virt(page_to_phys(page)); 303 reset_ctx(head); 304 ctx = &head->ctx; 305 frm = head->frame; 306 xdp->frame_cnt++; 307 308 act = bpf_prog_run_xdp(prog, ctx); 309 310 /* if program changed pkt bounds we need to update the xdp_frame */ 311 if (unlikely(ctx_was_changed(head))) { 312 ret = xdp_update_frame_from_buff(ctx, frm); 313 if (ret) { 314 xdp_return_buff(ctx); 315 continue; 316 } 317 } 318 319 switch (act) { 320 case XDP_TX: 321 /* we can't do a real XDP_TX since we're not in the 322 * driver, so turn it into a REDIRECT back to the same 323 * index 324 */ 325 ri->tgt_index = xdp->dev->ifindex; 326 ri->map_id = INT_MAX; 327 ri->map_type = BPF_MAP_TYPE_UNSPEC; 328 fallthrough; 329 case XDP_REDIRECT: 330 redirect = true; 331 ret = xdp_do_redirect_frame(xdp->dev, ctx, frm, prog); 332 if (ret) 333 xdp_return_buff(ctx); 334 break; 335 case XDP_PASS: 336 frames[nframes++] = frm; 337 break; 338 default: 339 bpf_warn_invalid_xdp_action(NULL, prog, act); 340 fallthrough; 341 case XDP_DROP: 342 xdp_return_buff(ctx); 343 break; 344 } 345 } 346 347 out: 348 if (redirect) 349 xdp_do_flush(); 350 if (nframes) { 351 ret = xdp_recv_frames(frames, nframes, xdp->skbs, xdp->dev); 352 if (ret) 353 err = ret; 354 } 355 356 xdp_clear_return_frame_no_direct(); 357 local_bh_enable(); 358 return err; 359 } 360 361 static int bpf_test_run_xdp_live(struct bpf_prog *prog, struct xdp_buff *ctx, 362 u32 repeat, u32 batch_size, u32 *time) 363 364 { 365 struct xdp_test_data xdp = { .batch_size = batch_size }; 366 struct bpf_test_timer t = { .mode = NO_MIGRATE }; 367 int ret; 368 369 if (!repeat) 370 repeat = 1; 371 372 ret = xdp_test_run_setup(&xdp, ctx); 373 if (ret) 374 return ret; 375 376 bpf_test_timer_enter(&t); 377 do { 378 xdp.frame_cnt = 0; 379 ret = xdp_test_run_batch(&xdp, prog, repeat - t.i); 380 if (unlikely(ret < 0)) 381 break; 382 } while (bpf_test_timer_continue(&t, xdp.frame_cnt, repeat, &ret, time)); 383 bpf_test_timer_leave(&t); 384 385 xdp_test_run_teardown(&xdp); 386 return ret; 387 } 388 389 static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, 390 u32 *retval, u32 *time, bool xdp) 391 { 392 struct bpf_prog_array_item item = {.prog = prog}; 393 struct bpf_run_ctx *old_ctx; 394 struct bpf_cg_run_ctx run_ctx; 395 struct bpf_test_timer t = { NO_MIGRATE }; 396 enum bpf_cgroup_storage_type stype; 397 int ret; 398 399 for_each_cgroup_storage_type(stype) { 400 item.cgroup_storage[stype] = bpf_cgroup_storage_alloc(prog, stype); 401 if (IS_ERR(item.cgroup_storage[stype])) { 402 item.cgroup_storage[stype] = NULL; 403 for_each_cgroup_storage_type(stype) 404 bpf_cgroup_storage_free(item.cgroup_storage[stype]); 405 return -ENOMEM; 406 } 407 } 408 409 if (!repeat) 410 repeat = 1; 411 412 bpf_test_timer_enter(&t); 413 old_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); 414 do { 415 run_ctx.prog_item = &item; 416 local_bh_disable(); 417 if (xdp) 418 *retval = bpf_prog_run_xdp(prog, ctx); 419 else 420 *retval = bpf_prog_run(prog, ctx); 421 local_bh_enable(); 422 } while (bpf_test_timer_continue(&t, 1, repeat, &ret, time)); 423 bpf_reset_run_ctx(old_ctx); 424 bpf_test_timer_leave(&t); 425 426 for_each_cgroup_storage_type(stype) 427 bpf_cgroup_storage_free(item.cgroup_storage[stype]); 428 429 return ret; 430 } 431 432 static int bpf_test_finish(const union bpf_attr *kattr, 433 union bpf_attr __user *uattr, const void *data, 434 struct skb_shared_info *sinfo, u32 size, 435 u32 retval, u32 duration) 436 { 437 void __user *data_out = u64_to_user_ptr(kattr->test.data_out); 438 int err = -EFAULT; 439 u32 copy_size = size; 440 441 /* Clamp copy if the user has provided a size hint, but copy the full 442 * buffer if not to retain old behaviour. 443 */ 444 if (kattr->test.data_size_out && 445 copy_size > kattr->test.data_size_out) { 446 copy_size = kattr->test.data_size_out; 447 err = -ENOSPC; 448 } 449 450 if (data_out) { 451 int len = sinfo ? copy_size - sinfo->xdp_frags_size : copy_size; 452 453 if (len < 0) { 454 err = -ENOSPC; 455 goto out; 456 } 457 458 if (copy_to_user(data_out, data, len)) 459 goto out; 460 461 if (sinfo) { 462 int i, offset = len; 463 u32 data_len; 464 465 for (i = 0; i < sinfo->nr_frags; i++) { 466 skb_frag_t *frag = &sinfo->frags[i]; 467 468 if (offset >= copy_size) { 469 err = -ENOSPC; 470 break; 471 } 472 473 data_len = min_t(u32, copy_size - offset, 474 skb_frag_size(frag)); 475 476 if (copy_to_user(data_out + offset, 477 skb_frag_address(frag), 478 data_len)) 479 goto out; 480 481 offset += data_len; 482 } 483 } 484 } 485 486 if (copy_to_user(&uattr->test.data_size_out, &size, sizeof(size))) 487 goto out; 488 if (copy_to_user(&uattr->test.retval, &retval, sizeof(retval))) 489 goto out; 490 if (copy_to_user(&uattr->test.duration, &duration, sizeof(duration))) 491 goto out; 492 if (err != -ENOSPC) 493 err = 0; 494 out: 495 trace_bpf_test_finish(&err); 496 return err; 497 } 498 499 /* Integer types of various sizes and pointer combinations cover variety of 500 * architecture dependent calling conventions. 7+ can be supported in the 501 * future. 502 */ 503 __diag_push(); 504 __diag_ignore_all("-Wmissing-prototypes", 505 "Global functions as their definitions will be in vmlinux BTF"); 506 __bpf_kfunc int bpf_fentry_test1(int a) 507 { 508 return a + 1; 509 } 510 EXPORT_SYMBOL_GPL(bpf_fentry_test1); 511 512 int noinline bpf_fentry_test2(int a, u64 b) 513 { 514 return a + b; 515 } 516 517 int noinline bpf_fentry_test3(char a, int b, u64 c) 518 { 519 return a + b + c; 520 } 521 522 int noinline bpf_fentry_test4(void *a, char b, int c, u64 d) 523 { 524 return (long)a + b + c + d; 525 } 526 527 int noinline bpf_fentry_test5(u64 a, void *b, short c, int d, u64 e) 528 { 529 return a + (long)b + c + d + e; 530 } 531 532 int noinline bpf_fentry_test6(u64 a, void *b, short c, int d, void *e, u64 f) 533 { 534 return a + (long)b + c + d + (long)e + f; 535 } 536 537 struct bpf_fentry_test_t { 538 struct bpf_fentry_test_t *a; 539 }; 540 541 int noinline bpf_fentry_test7(struct bpf_fentry_test_t *arg) 542 { 543 return (long)arg; 544 } 545 546 int noinline bpf_fentry_test8(struct bpf_fentry_test_t *arg) 547 { 548 return (long)arg->a; 549 } 550 551 __bpf_kfunc u32 bpf_fentry_test9(u32 *a) 552 { 553 return *a; 554 } 555 556 __bpf_kfunc int bpf_modify_return_test(int a, int *b) 557 { 558 *b += 1; 559 return a + *b; 560 } 561 562 __bpf_kfunc u64 bpf_kfunc_call_test1(struct sock *sk, u32 a, u64 b, u32 c, u64 d) 563 { 564 return a + b + c + d; 565 } 566 567 __bpf_kfunc int bpf_kfunc_call_test2(struct sock *sk, u32 a, u32 b) 568 { 569 return a + b; 570 } 571 572 __bpf_kfunc struct sock *bpf_kfunc_call_test3(struct sock *sk) 573 { 574 return sk; 575 } 576 577 long noinline bpf_kfunc_call_test4(signed char a, short b, int c, long d) 578 { 579 /* Provoke the compiler to assume that the caller has sign-extended a, 580 * b and c on platforms where this is required (e.g. s390x). 581 */ 582 return (long)a + (long)b + (long)c + d; 583 } 584 585 int noinline bpf_fentry_shadow_test(int a) 586 { 587 return a + 1; 588 } 589 590 struct prog_test_member1 { 591 int a; 592 }; 593 594 struct prog_test_member { 595 struct prog_test_member1 m; 596 int c; 597 }; 598 599 struct prog_test_ref_kfunc { 600 int a; 601 int b; 602 struct prog_test_member memb; 603 struct prog_test_ref_kfunc *next; 604 refcount_t cnt; 605 }; 606 607 static struct prog_test_ref_kfunc prog_test_struct = { 608 .a = 42, 609 .b = 108, 610 .next = &prog_test_struct, 611 .cnt = REFCOUNT_INIT(1), 612 }; 613 614 __bpf_kfunc struct prog_test_ref_kfunc * 615 bpf_kfunc_call_test_acquire(unsigned long *scalar_ptr) 616 { 617 refcount_inc(&prog_test_struct.cnt); 618 return &prog_test_struct; 619 } 620 621 __bpf_kfunc void bpf_kfunc_call_test_offset(struct prog_test_ref_kfunc *p) 622 { 623 WARN_ON_ONCE(1); 624 } 625 626 __bpf_kfunc struct prog_test_member * 627 bpf_kfunc_call_memb_acquire(void) 628 { 629 WARN_ON_ONCE(1); 630 return NULL; 631 } 632 633 __bpf_kfunc void bpf_kfunc_call_test_release(struct prog_test_ref_kfunc *p) 634 { 635 refcount_dec(&p->cnt); 636 } 637 638 __bpf_kfunc void bpf_kfunc_call_memb_release(struct prog_test_member *p) 639 { 640 } 641 642 __bpf_kfunc void bpf_kfunc_call_memb1_release(struct prog_test_member1 *p) 643 { 644 WARN_ON_ONCE(1); 645 } 646 647 static int *__bpf_kfunc_call_test_get_mem(struct prog_test_ref_kfunc *p, const int size) 648 { 649 if (size > 2 * sizeof(int)) 650 return NULL; 651 652 return (int *)p; 653 } 654 655 __bpf_kfunc int *bpf_kfunc_call_test_get_rdwr_mem(struct prog_test_ref_kfunc *p, 656 const int rdwr_buf_size) 657 { 658 return __bpf_kfunc_call_test_get_mem(p, rdwr_buf_size); 659 } 660 661 __bpf_kfunc int *bpf_kfunc_call_test_get_rdonly_mem(struct prog_test_ref_kfunc *p, 662 const int rdonly_buf_size) 663 { 664 return __bpf_kfunc_call_test_get_mem(p, rdonly_buf_size); 665 } 666 667 /* the next 2 ones can't be really used for testing expect to ensure 668 * that the verifier rejects the call. 669 * Acquire functions must return struct pointers, so these ones are 670 * failing. 671 */ 672 __bpf_kfunc int *bpf_kfunc_call_test_acq_rdonly_mem(struct prog_test_ref_kfunc *p, 673 const int rdonly_buf_size) 674 { 675 return __bpf_kfunc_call_test_get_mem(p, rdonly_buf_size); 676 } 677 678 __bpf_kfunc void bpf_kfunc_call_int_mem_release(int *p) 679 { 680 } 681 682 __bpf_kfunc struct prog_test_ref_kfunc * 683 bpf_kfunc_call_test_kptr_get(struct prog_test_ref_kfunc **pp, int a, int b) 684 { 685 struct prog_test_ref_kfunc *p = READ_ONCE(*pp); 686 687 if (!p) 688 return NULL; 689 refcount_inc(&p->cnt); 690 return p; 691 } 692 693 struct prog_test_pass1 { 694 int x0; 695 struct { 696 int x1; 697 struct { 698 int x2; 699 struct { 700 int x3; 701 }; 702 }; 703 }; 704 }; 705 706 struct prog_test_pass2 { 707 int len; 708 short arr1[4]; 709 struct { 710 char arr2[4]; 711 unsigned long arr3[8]; 712 } x; 713 }; 714 715 struct prog_test_fail1 { 716 void *p; 717 int x; 718 }; 719 720 struct prog_test_fail2 { 721 int x8; 722 struct prog_test_pass1 x; 723 }; 724 725 struct prog_test_fail3 { 726 int len; 727 char arr1[2]; 728 char arr2[]; 729 }; 730 731 __bpf_kfunc void bpf_kfunc_call_test_pass_ctx(struct __sk_buff *skb) 732 { 733 } 734 735 __bpf_kfunc void bpf_kfunc_call_test_pass1(struct prog_test_pass1 *p) 736 { 737 } 738 739 __bpf_kfunc void bpf_kfunc_call_test_pass2(struct prog_test_pass2 *p) 740 { 741 } 742 743 __bpf_kfunc void bpf_kfunc_call_test_fail1(struct prog_test_fail1 *p) 744 { 745 } 746 747 __bpf_kfunc void bpf_kfunc_call_test_fail2(struct prog_test_fail2 *p) 748 { 749 } 750 751 __bpf_kfunc void bpf_kfunc_call_test_fail3(struct prog_test_fail3 *p) 752 { 753 } 754 755 __bpf_kfunc void bpf_kfunc_call_test_mem_len_pass1(void *mem, int mem__sz) 756 { 757 } 758 759 __bpf_kfunc void bpf_kfunc_call_test_mem_len_fail1(void *mem, int len) 760 { 761 } 762 763 __bpf_kfunc void bpf_kfunc_call_test_mem_len_fail2(u64 *mem, int len) 764 { 765 } 766 767 __bpf_kfunc void bpf_kfunc_call_test_ref(struct prog_test_ref_kfunc *p) 768 { 769 /* p != NULL, but p->cnt could be 0 */ 770 } 771 772 __bpf_kfunc void bpf_kfunc_call_test_destructive(void) 773 { 774 } 775 776 __bpf_kfunc static u32 bpf_kfunc_call_test_static_unused_arg(u32 arg, u32 unused) 777 { 778 return arg; 779 } 780 781 __diag_pop(); 782 783 BTF_SET8_START(bpf_test_modify_return_ids) 784 BTF_ID_FLAGS(func, bpf_modify_return_test) 785 BTF_ID_FLAGS(func, bpf_fentry_test1, KF_SLEEPABLE) 786 BTF_SET8_END(bpf_test_modify_return_ids) 787 788 static const struct btf_kfunc_id_set bpf_test_modify_return_set = { 789 .owner = THIS_MODULE, 790 .set = &bpf_test_modify_return_ids, 791 }; 792 793 BTF_SET8_START(test_sk_check_kfunc_ids) 794 BTF_ID_FLAGS(func, bpf_kfunc_call_test1) 795 BTF_ID_FLAGS(func, bpf_kfunc_call_test2) 796 BTF_ID_FLAGS(func, bpf_kfunc_call_test3) 797 BTF_ID_FLAGS(func, bpf_kfunc_call_test4) 798 BTF_ID_FLAGS(func, bpf_kfunc_call_test_acquire, KF_ACQUIRE | KF_RET_NULL) 799 BTF_ID_FLAGS(func, bpf_kfunc_call_memb_acquire, KF_ACQUIRE | KF_RET_NULL) 800 BTF_ID_FLAGS(func, bpf_kfunc_call_test_release, KF_RELEASE) 801 BTF_ID_FLAGS(func, bpf_kfunc_call_memb_release, KF_RELEASE) 802 BTF_ID_FLAGS(func, bpf_kfunc_call_memb1_release, KF_RELEASE) 803 BTF_ID_FLAGS(func, bpf_kfunc_call_test_get_rdwr_mem, KF_RET_NULL) 804 BTF_ID_FLAGS(func, bpf_kfunc_call_test_get_rdonly_mem, KF_RET_NULL) 805 BTF_ID_FLAGS(func, bpf_kfunc_call_test_acq_rdonly_mem, KF_ACQUIRE | KF_RET_NULL) 806 BTF_ID_FLAGS(func, bpf_kfunc_call_int_mem_release, KF_RELEASE) 807 BTF_ID_FLAGS(func, bpf_kfunc_call_test_kptr_get, KF_ACQUIRE | KF_RET_NULL | KF_KPTR_GET) 808 BTF_ID_FLAGS(func, bpf_kfunc_call_test_pass_ctx) 809 BTF_ID_FLAGS(func, bpf_kfunc_call_test_pass1) 810 BTF_ID_FLAGS(func, bpf_kfunc_call_test_pass2) 811 BTF_ID_FLAGS(func, bpf_kfunc_call_test_fail1) 812 BTF_ID_FLAGS(func, bpf_kfunc_call_test_fail2) 813 BTF_ID_FLAGS(func, bpf_kfunc_call_test_fail3) 814 BTF_ID_FLAGS(func, bpf_kfunc_call_test_mem_len_pass1) 815 BTF_ID_FLAGS(func, bpf_kfunc_call_test_mem_len_fail1) 816 BTF_ID_FLAGS(func, bpf_kfunc_call_test_mem_len_fail2) 817 BTF_ID_FLAGS(func, bpf_kfunc_call_test_ref, KF_TRUSTED_ARGS | KF_RCU) 818 BTF_ID_FLAGS(func, bpf_kfunc_call_test_destructive, KF_DESTRUCTIVE) 819 BTF_ID_FLAGS(func, bpf_kfunc_call_test_static_unused_arg) 820 BTF_ID_FLAGS(func, bpf_kfunc_call_test_offset) 821 BTF_SET8_END(test_sk_check_kfunc_ids) 822 823 static void *bpf_test_init(const union bpf_attr *kattr, u32 user_size, 824 u32 size, u32 headroom, u32 tailroom) 825 { 826 void __user *data_in = u64_to_user_ptr(kattr->test.data_in); 827 void *data; 828 829 if (size < ETH_HLEN || size > PAGE_SIZE - headroom - tailroom) 830 return ERR_PTR(-EINVAL); 831 832 if (user_size > size) 833 return ERR_PTR(-EMSGSIZE); 834 835 size = SKB_DATA_ALIGN(size); 836 data = kzalloc(size + headroom + tailroom, GFP_USER); 837 if (!data) 838 return ERR_PTR(-ENOMEM); 839 840 if (copy_from_user(data + headroom, data_in, user_size)) { 841 kfree(data); 842 return ERR_PTR(-EFAULT); 843 } 844 845 return data; 846 } 847 848 int bpf_prog_test_run_tracing(struct bpf_prog *prog, 849 const union bpf_attr *kattr, 850 union bpf_attr __user *uattr) 851 { 852 struct bpf_fentry_test_t arg = {}; 853 u16 side_effect = 0, ret = 0; 854 int b = 2, err = -EFAULT; 855 u32 retval = 0; 856 857 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size) 858 return -EINVAL; 859 860 switch (prog->expected_attach_type) { 861 case BPF_TRACE_FENTRY: 862 case BPF_TRACE_FEXIT: 863 if (bpf_fentry_test1(1) != 2 || 864 bpf_fentry_test2(2, 3) != 5 || 865 bpf_fentry_test3(4, 5, 6) != 15 || 866 bpf_fentry_test4((void *)7, 8, 9, 10) != 34 || 867 bpf_fentry_test5(11, (void *)12, 13, 14, 15) != 65 || 868 bpf_fentry_test6(16, (void *)17, 18, 19, (void *)20, 21) != 111 || 869 bpf_fentry_test7((struct bpf_fentry_test_t *)0) != 0 || 870 bpf_fentry_test8(&arg) != 0 || 871 bpf_fentry_test9(&retval) != 0) 872 goto out; 873 break; 874 case BPF_MODIFY_RETURN: 875 ret = bpf_modify_return_test(1, &b); 876 if (b != 2) 877 side_effect = 1; 878 break; 879 default: 880 goto out; 881 } 882 883 retval = ((u32)side_effect << 16) | ret; 884 if (copy_to_user(&uattr->test.retval, &retval, sizeof(retval))) 885 goto out; 886 887 err = 0; 888 out: 889 trace_bpf_test_finish(&err); 890 return err; 891 } 892 893 struct bpf_raw_tp_test_run_info { 894 struct bpf_prog *prog; 895 void *ctx; 896 u32 retval; 897 }; 898 899 static void 900 __bpf_prog_test_run_raw_tp(void *data) 901 { 902 struct bpf_raw_tp_test_run_info *info = data; 903 904 rcu_read_lock(); 905 info->retval = bpf_prog_run(info->prog, info->ctx); 906 rcu_read_unlock(); 907 } 908 909 int bpf_prog_test_run_raw_tp(struct bpf_prog *prog, 910 const union bpf_attr *kattr, 911 union bpf_attr __user *uattr) 912 { 913 void __user *ctx_in = u64_to_user_ptr(kattr->test.ctx_in); 914 __u32 ctx_size_in = kattr->test.ctx_size_in; 915 struct bpf_raw_tp_test_run_info info; 916 int cpu = kattr->test.cpu, err = 0; 917 int current_cpu; 918 919 /* doesn't support data_in/out, ctx_out, duration, or repeat */ 920 if (kattr->test.data_in || kattr->test.data_out || 921 kattr->test.ctx_out || kattr->test.duration || 922 kattr->test.repeat || kattr->test.batch_size) 923 return -EINVAL; 924 925 if (ctx_size_in < prog->aux->max_ctx_offset || 926 ctx_size_in > MAX_BPF_FUNC_ARGS * sizeof(u64)) 927 return -EINVAL; 928 929 if ((kattr->test.flags & BPF_F_TEST_RUN_ON_CPU) == 0 && cpu != 0) 930 return -EINVAL; 931 932 if (ctx_size_in) { 933 info.ctx = memdup_user(ctx_in, ctx_size_in); 934 if (IS_ERR(info.ctx)) 935 return PTR_ERR(info.ctx); 936 } else { 937 info.ctx = NULL; 938 } 939 940 info.prog = prog; 941 942 current_cpu = get_cpu(); 943 if ((kattr->test.flags & BPF_F_TEST_RUN_ON_CPU) == 0 || 944 cpu == current_cpu) { 945 __bpf_prog_test_run_raw_tp(&info); 946 } else if (cpu >= nr_cpu_ids || !cpu_online(cpu)) { 947 /* smp_call_function_single() also checks cpu_online() 948 * after csd_lock(). However, since cpu is from user 949 * space, let's do an extra quick check to filter out 950 * invalid value before smp_call_function_single(). 951 */ 952 err = -ENXIO; 953 } else { 954 err = smp_call_function_single(cpu, __bpf_prog_test_run_raw_tp, 955 &info, 1); 956 } 957 put_cpu(); 958 959 if (!err && 960 copy_to_user(&uattr->test.retval, &info.retval, sizeof(u32))) 961 err = -EFAULT; 962 963 kfree(info.ctx); 964 return err; 965 } 966 967 static void *bpf_ctx_init(const union bpf_attr *kattr, u32 max_size) 968 { 969 void __user *data_in = u64_to_user_ptr(kattr->test.ctx_in); 970 void __user *data_out = u64_to_user_ptr(kattr->test.ctx_out); 971 u32 size = kattr->test.ctx_size_in; 972 void *data; 973 int err; 974 975 if (!data_in && !data_out) 976 return NULL; 977 978 data = kzalloc(max_size, GFP_USER); 979 if (!data) 980 return ERR_PTR(-ENOMEM); 981 982 if (data_in) { 983 err = bpf_check_uarg_tail_zero(USER_BPFPTR(data_in), max_size, size); 984 if (err) { 985 kfree(data); 986 return ERR_PTR(err); 987 } 988 989 size = min_t(u32, max_size, size); 990 if (copy_from_user(data, data_in, size)) { 991 kfree(data); 992 return ERR_PTR(-EFAULT); 993 } 994 } 995 return data; 996 } 997 998 static int bpf_ctx_finish(const union bpf_attr *kattr, 999 union bpf_attr __user *uattr, const void *data, 1000 u32 size) 1001 { 1002 void __user *data_out = u64_to_user_ptr(kattr->test.ctx_out); 1003 int err = -EFAULT; 1004 u32 copy_size = size; 1005 1006 if (!data || !data_out) 1007 return 0; 1008 1009 if (copy_size > kattr->test.ctx_size_out) { 1010 copy_size = kattr->test.ctx_size_out; 1011 err = -ENOSPC; 1012 } 1013 1014 if (copy_to_user(data_out, data, copy_size)) 1015 goto out; 1016 if (copy_to_user(&uattr->test.ctx_size_out, &size, sizeof(size))) 1017 goto out; 1018 if (err != -ENOSPC) 1019 err = 0; 1020 out: 1021 return err; 1022 } 1023 1024 /** 1025 * range_is_zero - test whether buffer is initialized 1026 * @buf: buffer to check 1027 * @from: check from this position 1028 * @to: check up until (excluding) this position 1029 * 1030 * This function returns true if the there is a non-zero byte 1031 * in the buf in the range [from,to). 1032 */ 1033 static inline bool range_is_zero(void *buf, size_t from, size_t to) 1034 { 1035 return !memchr_inv((u8 *)buf + from, 0, to - from); 1036 } 1037 1038 static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb) 1039 { 1040 struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; 1041 1042 if (!__skb) 1043 return 0; 1044 1045 /* make sure the fields we don't use are zeroed */ 1046 if (!range_is_zero(__skb, 0, offsetof(struct __sk_buff, mark))) 1047 return -EINVAL; 1048 1049 /* mark is allowed */ 1050 1051 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, mark), 1052 offsetof(struct __sk_buff, priority))) 1053 return -EINVAL; 1054 1055 /* priority is allowed */ 1056 /* ingress_ifindex is allowed */ 1057 /* ifindex is allowed */ 1058 1059 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, ifindex), 1060 offsetof(struct __sk_buff, cb))) 1061 return -EINVAL; 1062 1063 /* cb is allowed */ 1064 1065 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, cb), 1066 offsetof(struct __sk_buff, tstamp))) 1067 return -EINVAL; 1068 1069 /* tstamp is allowed */ 1070 /* wire_len is allowed */ 1071 /* gso_segs is allowed */ 1072 1073 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, gso_segs), 1074 offsetof(struct __sk_buff, gso_size))) 1075 return -EINVAL; 1076 1077 /* gso_size is allowed */ 1078 1079 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, gso_size), 1080 offsetof(struct __sk_buff, hwtstamp))) 1081 return -EINVAL; 1082 1083 /* hwtstamp is allowed */ 1084 1085 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, hwtstamp), 1086 sizeof(struct __sk_buff))) 1087 return -EINVAL; 1088 1089 skb->mark = __skb->mark; 1090 skb->priority = __skb->priority; 1091 skb->skb_iif = __skb->ingress_ifindex; 1092 skb->tstamp = __skb->tstamp; 1093 memcpy(&cb->data, __skb->cb, QDISC_CB_PRIV_LEN); 1094 1095 if (__skb->wire_len == 0) { 1096 cb->pkt_len = skb->len; 1097 } else { 1098 if (__skb->wire_len < skb->len || 1099 __skb->wire_len > GSO_LEGACY_MAX_SIZE) 1100 return -EINVAL; 1101 cb->pkt_len = __skb->wire_len; 1102 } 1103 1104 if (__skb->gso_segs > GSO_MAX_SEGS) 1105 return -EINVAL; 1106 skb_shinfo(skb)->gso_segs = __skb->gso_segs; 1107 skb_shinfo(skb)->gso_size = __skb->gso_size; 1108 skb_shinfo(skb)->hwtstamps.hwtstamp = __skb->hwtstamp; 1109 1110 return 0; 1111 } 1112 1113 static void convert_skb_to___skb(struct sk_buff *skb, struct __sk_buff *__skb) 1114 { 1115 struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; 1116 1117 if (!__skb) 1118 return; 1119 1120 __skb->mark = skb->mark; 1121 __skb->priority = skb->priority; 1122 __skb->ingress_ifindex = skb->skb_iif; 1123 __skb->ifindex = skb->dev->ifindex; 1124 __skb->tstamp = skb->tstamp; 1125 memcpy(__skb->cb, &cb->data, QDISC_CB_PRIV_LEN); 1126 __skb->wire_len = cb->pkt_len; 1127 __skb->gso_segs = skb_shinfo(skb)->gso_segs; 1128 __skb->hwtstamp = skb_shinfo(skb)->hwtstamps.hwtstamp; 1129 } 1130 1131 static struct proto bpf_dummy_proto = { 1132 .name = "bpf_dummy", 1133 .owner = THIS_MODULE, 1134 .obj_size = sizeof(struct sock), 1135 }; 1136 1137 int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 1138 union bpf_attr __user *uattr) 1139 { 1140 bool is_l2 = false, is_direct_pkt_access = false; 1141 struct net *net = current->nsproxy->net_ns; 1142 struct net_device *dev = net->loopback_dev; 1143 u32 size = kattr->test.data_size_in; 1144 u32 repeat = kattr->test.repeat; 1145 struct __sk_buff *ctx = NULL; 1146 u32 retval, duration; 1147 int hh_len = ETH_HLEN; 1148 struct sk_buff *skb; 1149 struct sock *sk; 1150 void *data; 1151 int ret; 1152 1153 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size) 1154 return -EINVAL; 1155 1156 data = bpf_test_init(kattr, kattr->test.data_size_in, 1157 size, NET_SKB_PAD + NET_IP_ALIGN, 1158 SKB_DATA_ALIGN(sizeof(struct skb_shared_info))); 1159 if (IS_ERR(data)) 1160 return PTR_ERR(data); 1161 1162 ctx = bpf_ctx_init(kattr, sizeof(struct __sk_buff)); 1163 if (IS_ERR(ctx)) { 1164 kfree(data); 1165 return PTR_ERR(ctx); 1166 } 1167 1168 switch (prog->type) { 1169 case BPF_PROG_TYPE_SCHED_CLS: 1170 case BPF_PROG_TYPE_SCHED_ACT: 1171 is_l2 = true; 1172 fallthrough; 1173 case BPF_PROG_TYPE_LWT_IN: 1174 case BPF_PROG_TYPE_LWT_OUT: 1175 case BPF_PROG_TYPE_LWT_XMIT: 1176 is_direct_pkt_access = true; 1177 break; 1178 default: 1179 break; 1180 } 1181 1182 sk = sk_alloc(net, AF_UNSPEC, GFP_USER, &bpf_dummy_proto, 1); 1183 if (!sk) { 1184 kfree(data); 1185 kfree(ctx); 1186 return -ENOMEM; 1187 } 1188 sock_init_data(NULL, sk); 1189 1190 skb = slab_build_skb(data); 1191 if (!skb) { 1192 kfree(data); 1193 kfree(ctx); 1194 sk_free(sk); 1195 return -ENOMEM; 1196 } 1197 skb->sk = sk; 1198 1199 skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN); 1200 __skb_put(skb, size); 1201 if (ctx && ctx->ifindex > 1) { 1202 dev = dev_get_by_index(net, ctx->ifindex); 1203 if (!dev) { 1204 ret = -ENODEV; 1205 goto out; 1206 } 1207 } 1208 skb->protocol = eth_type_trans(skb, dev); 1209 skb_reset_network_header(skb); 1210 1211 switch (skb->protocol) { 1212 case htons(ETH_P_IP): 1213 sk->sk_family = AF_INET; 1214 if (sizeof(struct iphdr) <= skb_headlen(skb)) { 1215 sk->sk_rcv_saddr = ip_hdr(skb)->saddr; 1216 sk->sk_daddr = ip_hdr(skb)->daddr; 1217 } 1218 break; 1219 #if IS_ENABLED(CONFIG_IPV6) 1220 case htons(ETH_P_IPV6): 1221 sk->sk_family = AF_INET6; 1222 if (sizeof(struct ipv6hdr) <= skb_headlen(skb)) { 1223 sk->sk_v6_rcv_saddr = ipv6_hdr(skb)->saddr; 1224 sk->sk_v6_daddr = ipv6_hdr(skb)->daddr; 1225 } 1226 break; 1227 #endif 1228 default: 1229 break; 1230 } 1231 1232 if (is_l2) 1233 __skb_push(skb, hh_len); 1234 if (is_direct_pkt_access) 1235 bpf_compute_data_pointers(skb); 1236 ret = convert___skb_to_skb(skb, ctx); 1237 if (ret) 1238 goto out; 1239 ret = bpf_test_run(prog, skb, repeat, &retval, &duration, false); 1240 if (ret) 1241 goto out; 1242 if (!is_l2) { 1243 if (skb_headroom(skb) < hh_len) { 1244 int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb)); 1245 1246 if (pskb_expand_head(skb, nhead, 0, GFP_USER)) { 1247 ret = -ENOMEM; 1248 goto out; 1249 } 1250 } 1251 memset(__skb_push(skb, hh_len), 0, hh_len); 1252 } 1253 convert_skb_to___skb(skb, ctx); 1254 1255 size = skb->len; 1256 /* bpf program can never convert linear skb to non-linear */ 1257 if (WARN_ON_ONCE(skb_is_nonlinear(skb))) 1258 size = skb_headlen(skb); 1259 ret = bpf_test_finish(kattr, uattr, skb->data, NULL, size, retval, 1260 duration); 1261 if (!ret) 1262 ret = bpf_ctx_finish(kattr, uattr, ctx, 1263 sizeof(struct __sk_buff)); 1264 out: 1265 if (dev && dev != net->loopback_dev) 1266 dev_put(dev); 1267 kfree_skb(skb); 1268 sk_free(sk); 1269 kfree(ctx); 1270 return ret; 1271 } 1272 1273 static int xdp_convert_md_to_buff(struct xdp_md *xdp_md, struct xdp_buff *xdp) 1274 { 1275 unsigned int ingress_ifindex, rx_queue_index; 1276 struct netdev_rx_queue *rxqueue; 1277 struct net_device *device; 1278 1279 if (!xdp_md) 1280 return 0; 1281 1282 if (xdp_md->egress_ifindex != 0) 1283 return -EINVAL; 1284 1285 ingress_ifindex = xdp_md->ingress_ifindex; 1286 rx_queue_index = xdp_md->rx_queue_index; 1287 1288 if (!ingress_ifindex && rx_queue_index) 1289 return -EINVAL; 1290 1291 if (ingress_ifindex) { 1292 device = dev_get_by_index(current->nsproxy->net_ns, 1293 ingress_ifindex); 1294 if (!device) 1295 return -ENODEV; 1296 1297 if (rx_queue_index >= device->real_num_rx_queues) 1298 goto free_dev; 1299 1300 rxqueue = __netif_get_rx_queue(device, rx_queue_index); 1301 1302 if (!xdp_rxq_info_is_reg(&rxqueue->xdp_rxq)) 1303 goto free_dev; 1304 1305 xdp->rxq = &rxqueue->xdp_rxq; 1306 /* The device is now tracked in the xdp->rxq for later 1307 * dev_put() 1308 */ 1309 } 1310 1311 xdp->data = xdp->data_meta + xdp_md->data; 1312 return 0; 1313 1314 free_dev: 1315 dev_put(device); 1316 return -EINVAL; 1317 } 1318 1319 static void xdp_convert_buff_to_md(struct xdp_buff *xdp, struct xdp_md *xdp_md) 1320 { 1321 if (!xdp_md) 1322 return; 1323 1324 xdp_md->data = xdp->data - xdp->data_meta; 1325 xdp_md->data_end = xdp->data_end - xdp->data_meta; 1326 1327 if (xdp_md->ingress_ifindex) 1328 dev_put(xdp->rxq->dev); 1329 } 1330 1331 int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, 1332 union bpf_attr __user *uattr) 1333 { 1334 bool do_live = (kattr->test.flags & BPF_F_TEST_XDP_LIVE_FRAMES); 1335 u32 tailroom = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); 1336 u32 batch_size = kattr->test.batch_size; 1337 u32 retval = 0, duration, max_data_sz; 1338 u32 size = kattr->test.data_size_in; 1339 u32 headroom = XDP_PACKET_HEADROOM; 1340 u32 repeat = kattr->test.repeat; 1341 struct netdev_rx_queue *rxqueue; 1342 struct skb_shared_info *sinfo; 1343 struct xdp_buff xdp = {}; 1344 int i, ret = -EINVAL; 1345 struct xdp_md *ctx; 1346 void *data; 1347 1348 if (prog->expected_attach_type == BPF_XDP_DEVMAP || 1349 prog->expected_attach_type == BPF_XDP_CPUMAP) 1350 return -EINVAL; 1351 1352 if (kattr->test.flags & ~BPF_F_TEST_XDP_LIVE_FRAMES) 1353 return -EINVAL; 1354 1355 if (bpf_prog_is_dev_bound(prog->aux)) 1356 return -EINVAL; 1357 1358 if (do_live) { 1359 if (!batch_size) 1360 batch_size = NAPI_POLL_WEIGHT; 1361 else if (batch_size > TEST_XDP_MAX_BATCH) 1362 return -E2BIG; 1363 1364 headroom += sizeof(struct xdp_page_head); 1365 } else if (batch_size) { 1366 return -EINVAL; 1367 } 1368 1369 ctx = bpf_ctx_init(kattr, sizeof(struct xdp_md)); 1370 if (IS_ERR(ctx)) 1371 return PTR_ERR(ctx); 1372 1373 if (ctx) { 1374 /* There can't be user provided data before the meta data */ 1375 if (ctx->data_meta || ctx->data_end != size || 1376 ctx->data > ctx->data_end || 1377 unlikely(xdp_metalen_invalid(ctx->data)) || 1378 (do_live && (kattr->test.data_out || kattr->test.ctx_out))) 1379 goto free_ctx; 1380 /* Meta data is allocated from the headroom */ 1381 headroom -= ctx->data; 1382 } 1383 1384 max_data_sz = 4096 - headroom - tailroom; 1385 if (size > max_data_sz) { 1386 /* disallow live data mode for jumbo frames */ 1387 if (do_live) 1388 goto free_ctx; 1389 size = max_data_sz; 1390 } 1391 1392 data = bpf_test_init(kattr, size, max_data_sz, headroom, tailroom); 1393 if (IS_ERR(data)) { 1394 ret = PTR_ERR(data); 1395 goto free_ctx; 1396 } 1397 1398 rxqueue = __netif_get_rx_queue(current->nsproxy->net_ns->loopback_dev, 0); 1399 rxqueue->xdp_rxq.frag_size = headroom + max_data_sz + tailroom; 1400 xdp_init_buff(&xdp, rxqueue->xdp_rxq.frag_size, &rxqueue->xdp_rxq); 1401 xdp_prepare_buff(&xdp, data, headroom, size, true); 1402 sinfo = xdp_get_shared_info_from_buff(&xdp); 1403 1404 ret = xdp_convert_md_to_buff(ctx, &xdp); 1405 if (ret) 1406 goto free_data; 1407 1408 if (unlikely(kattr->test.data_size_in > size)) { 1409 void __user *data_in = u64_to_user_ptr(kattr->test.data_in); 1410 1411 while (size < kattr->test.data_size_in) { 1412 struct page *page; 1413 skb_frag_t *frag; 1414 u32 data_len; 1415 1416 if (sinfo->nr_frags == MAX_SKB_FRAGS) { 1417 ret = -ENOMEM; 1418 goto out; 1419 } 1420 1421 page = alloc_page(GFP_KERNEL); 1422 if (!page) { 1423 ret = -ENOMEM; 1424 goto out; 1425 } 1426 1427 frag = &sinfo->frags[sinfo->nr_frags++]; 1428 __skb_frag_set_page(frag, page); 1429 1430 data_len = min_t(u32, kattr->test.data_size_in - size, 1431 PAGE_SIZE); 1432 skb_frag_size_set(frag, data_len); 1433 1434 if (copy_from_user(page_address(page), data_in + size, 1435 data_len)) { 1436 ret = -EFAULT; 1437 goto out; 1438 } 1439 sinfo->xdp_frags_size += data_len; 1440 size += data_len; 1441 } 1442 xdp_buff_set_frags_flag(&xdp); 1443 } 1444 1445 if (repeat > 1) 1446 bpf_prog_change_xdp(NULL, prog); 1447 1448 if (do_live) 1449 ret = bpf_test_run_xdp_live(prog, &xdp, repeat, batch_size, &duration); 1450 else 1451 ret = bpf_test_run(prog, &xdp, repeat, &retval, &duration, true); 1452 /* We convert the xdp_buff back to an xdp_md before checking the return 1453 * code so the reference count of any held netdevice will be decremented 1454 * even if the test run failed. 1455 */ 1456 xdp_convert_buff_to_md(&xdp, ctx); 1457 if (ret) 1458 goto out; 1459 1460 size = xdp.data_end - xdp.data_meta + sinfo->xdp_frags_size; 1461 ret = bpf_test_finish(kattr, uattr, xdp.data_meta, sinfo, size, 1462 retval, duration); 1463 if (!ret) 1464 ret = bpf_ctx_finish(kattr, uattr, ctx, 1465 sizeof(struct xdp_md)); 1466 1467 out: 1468 if (repeat > 1) 1469 bpf_prog_change_xdp(prog, NULL); 1470 free_data: 1471 for (i = 0; i < sinfo->nr_frags; i++) 1472 __free_page(skb_frag_page(&sinfo->frags[i])); 1473 kfree(data); 1474 free_ctx: 1475 kfree(ctx); 1476 return ret; 1477 } 1478 1479 static int verify_user_bpf_flow_keys(struct bpf_flow_keys *ctx) 1480 { 1481 /* make sure the fields we don't use are zeroed */ 1482 if (!range_is_zero(ctx, 0, offsetof(struct bpf_flow_keys, flags))) 1483 return -EINVAL; 1484 1485 /* flags is allowed */ 1486 1487 if (!range_is_zero(ctx, offsetofend(struct bpf_flow_keys, flags), 1488 sizeof(struct bpf_flow_keys))) 1489 return -EINVAL; 1490 1491 return 0; 1492 } 1493 1494 int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog, 1495 const union bpf_attr *kattr, 1496 union bpf_attr __user *uattr) 1497 { 1498 struct bpf_test_timer t = { NO_PREEMPT }; 1499 u32 size = kattr->test.data_size_in; 1500 struct bpf_flow_dissector ctx = {}; 1501 u32 repeat = kattr->test.repeat; 1502 struct bpf_flow_keys *user_ctx; 1503 struct bpf_flow_keys flow_keys; 1504 const struct ethhdr *eth; 1505 unsigned int flags = 0; 1506 u32 retval, duration; 1507 void *data; 1508 int ret; 1509 1510 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size) 1511 return -EINVAL; 1512 1513 if (size < ETH_HLEN) 1514 return -EINVAL; 1515 1516 data = bpf_test_init(kattr, kattr->test.data_size_in, size, 0, 0); 1517 if (IS_ERR(data)) 1518 return PTR_ERR(data); 1519 1520 eth = (struct ethhdr *)data; 1521 1522 if (!repeat) 1523 repeat = 1; 1524 1525 user_ctx = bpf_ctx_init(kattr, sizeof(struct bpf_flow_keys)); 1526 if (IS_ERR(user_ctx)) { 1527 kfree(data); 1528 return PTR_ERR(user_ctx); 1529 } 1530 if (user_ctx) { 1531 ret = verify_user_bpf_flow_keys(user_ctx); 1532 if (ret) 1533 goto out; 1534 flags = user_ctx->flags; 1535 } 1536 1537 ctx.flow_keys = &flow_keys; 1538 ctx.data = data; 1539 ctx.data_end = (__u8 *)data + size; 1540 1541 bpf_test_timer_enter(&t); 1542 do { 1543 retval = bpf_flow_dissect(prog, &ctx, eth->h_proto, ETH_HLEN, 1544 size, flags); 1545 } while (bpf_test_timer_continue(&t, 1, repeat, &ret, &duration)); 1546 bpf_test_timer_leave(&t); 1547 1548 if (ret < 0) 1549 goto out; 1550 1551 ret = bpf_test_finish(kattr, uattr, &flow_keys, NULL, 1552 sizeof(flow_keys), retval, duration); 1553 if (!ret) 1554 ret = bpf_ctx_finish(kattr, uattr, user_ctx, 1555 sizeof(struct bpf_flow_keys)); 1556 1557 out: 1558 kfree(user_ctx); 1559 kfree(data); 1560 return ret; 1561 } 1562 1563 int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog, const union bpf_attr *kattr, 1564 union bpf_attr __user *uattr) 1565 { 1566 struct bpf_test_timer t = { NO_PREEMPT }; 1567 struct bpf_prog_array *progs = NULL; 1568 struct bpf_sk_lookup_kern ctx = {}; 1569 u32 repeat = kattr->test.repeat; 1570 struct bpf_sk_lookup *user_ctx; 1571 u32 retval, duration; 1572 int ret = -EINVAL; 1573 1574 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size) 1575 return -EINVAL; 1576 1577 if (kattr->test.data_in || kattr->test.data_size_in || kattr->test.data_out || 1578 kattr->test.data_size_out) 1579 return -EINVAL; 1580 1581 if (!repeat) 1582 repeat = 1; 1583 1584 user_ctx = bpf_ctx_init(kattr, sizeof(*user_ctx)); 1585 if (IS_ERR(user_ctx)) 1586 return PTR_ERR(user_ctx); 1587 1588 if (!user_ctx) 1589 return -EINVAL; 1590 1591 if (user_ctx->sk) 1592 goto out; 1593 1594 if (!range_is_zero(user_ctx, offsetofend(typeof(*user_ctx), local_port), sizeof(*user_ctx))) 1595 goto out; 1596 1597 if (user_ctx->local_port > U16_MAX) { 1598 ret = -ERANGE; 1599 goto out; 1600 } 1601 1602 ctx.family = (u16)user_ctx->family; 1603 ctx.protocol = (u16)user_ctx->protocol; 1604 ctx.dport = (u16)user_ctx->local_port; 1605 ctx.sport = user_ctx->remote_port; 1606 1607 switch (ctx.family) { 1608 case AF_INET: 1609 ctx.v4.daddr = (__force __be32)user_ctx->local_ip4; 1610 ctx.v4.saddr = (__force __be32)user_ctx->remote_ip4; 1611 break; 1612 1613 #if IS_ENABLED(CONFIG_IPV6) 1614 case AF_INET6: 1615 ctx.v6.daddr = (struct in6_addr *)user_ctx->local_ip6; 1616 ctx.v6.saddr = (struct in6_addr *)user_ctx->remote_ip6; 1617 break; 1618 #endif 1619 1620 default: 1621 ret = -EAFNOSUPPORT; 1622 goto out; 1623 } 1624 1625 progs = bpf_prog_array_alloc(1, GFP_KERNEL); 1626 if (!progs) { 1627 ret = -ENOMEM; 1628 goto out; 1629 } 1630 1631 progs->items[0].prog = prog; 1632 1633 bpf_test_timer_enter(&t); 1634 do { 1635 ctx.selected_sk = NULL; 1636 retval = BPF_PROG_SK_LOOKUP_RUN_ARRAY(progs, ctx, bpf_prog_run); 1637 } while (bpf_test_timer_continue(&t, 1, repeat, &ret, &duration)); 1638 bpf_test_timer_leave(&t); 1639 1640 if (ret < 0) 1641 goto out; 1642 1643 user_ctx->cookie = 0; 1644 if (ctx.selected_sk) { 1645 if (ctx.selected_sk->sk_reuseport && !ctx.no_reuseport) { 1646 ret = -EOPNOTSUPP; 1647 goto out; 1648 } 1649 1650 user_ctx->cookie = sock_gen_cookie(ctx.selected_sk); 1651 } 1652 1653 ret = bpf_test_finish(kattr, uattr, NULL, NULL, 0, retval, duration); 1654 if (!ret) 1655 ret = bpf_ctx_finish(kattr, uattr, user_ctx, sizeof(*user_ctx)); 1656 1657 out: 1658 bpf_prog_array_free(progs); 1659 kfree(user_ctx); 1660 return ret; 1661 } 1662 1663 int bpf_prog_test_run_syscall(struct bpf_prog *prog, 1664 const union bpf_attr *kattr, 1665 union bpf_attr __user *uattr) 1666 { 1667 void __user *ctx_in = u64_to_user_ptr(kattr->test.ctx_in); 1668 __u32 ctx_size_in = kattr->test.ctx_size_in; 1669 void *ctx = NULL; 1670 u32 retval; 1671 int err = 0; 1672 1673 /* doesn't support data_in/out, ctx_out, duration, or repeat or flags */ 1674 if (kattr->test.data_in || kattr->test.data_out || 1675 kattr->test.ctx_out || kattr->test.duration || 1676 kattr->test.repeat || kattr->test.flags || 1677 kattr->test.batch_size) 1678 return -EINVAL; 1679 1680 if (ctx_size_in < prog->aux->max_ctx_offset || 1681 ctx_size_in > U16_MAX) 1682 return -EINVAL; 1683 1684 if (ctx_size_in) { 1685 ctx = memdup_user(ctx_in, ctx_size_in); 1686 if (IS_ERR(ctx)) 1687 return PTR_ERR(ctx); 1688 } 1689 1690 rcu_read_lock_trace(); 1691 retval = bpf_prog_run_pin_on_cpu(prog, ctx); 1692 rcu_read_unlock_trace(); 1693 1694 if (copy_to_user(&uattr->test.retval, &retval, sizeof(u32))) { 1695 err = -EFAULT; 1696 goto out; 1697 } 1698 if (ctx_size_in) 1699 if (copy_to_user(ctx_in, ctx, ctx_size_in)) 1700 err = -EFAULT; 1701 out: 1702 kfree(ctx); 1703 return err; 1704 } 1705 1706 static const struct btf_kfunc_id_set bpf_prog_test_kfunc_set = { 1707 .owner = THIS_MODULE, 1708 .set = &test_sk_check_kfunc_ids, 1709 }; 1710 1711 BTF_ID_LIST(bpf_prog_test_dtor_kfunc_ids) 1712 BTF_ID(struct, prog_test_ref_kfunc) 1713 BTF_ID(func, bpf_kfunc_call_test_release) 1714 BTF_ID(struct, prog_test_member) 1715 BTF_ID(func, bpf_kfunc_call_memb_release) 1716 1717 static int __init bpf_prog_test_run_init(void) 1718 { 1719 const struct btf_id_dtor_kfunc bpf_prog_test_dtor_kfunc[] = { 1720 { 1721 .btf_id = bpf_prog_test_dtor_kfunc_ids[0], 1722 .kfunc_btf_id = bpf_prog_test_dtor_kfunc_ids[1] 1723 }, 1724 { 1725 .btf_id = bpf_prog_test_dtor_kfunc_ids[2], 1726 .kfunc_btf_id = bpf_prog_test_dtor_kfunc_ids[3], 1727 }, 1728 }; 1729 int ret; 1730 1731 ret = register_btf_fmodret_id_set(&bpf_test_modify_return_set); 1732 ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &bpf_prog_test_kfunc_set); 1733 ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING, &bpf_prog_test_kfunc_set); 1734 ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &bpf_prog_test_kfunc_set); 1735 return ret ?: register_btf_id_dtor_kfuncs(bpf_prog_test_dtor_kfunc, 1736 ARRAY_SIZE(bpf_prog_test_dtor_kfunc), 1737 THIS_MODULE); 1738 } 1739 late_initcall(bpf_prog_test_run_init); 1740